[{"data":1,"prerenderedAt":437},["ShallowReactive",2],{"navigation_docs":3,"-install-activation":136,"-install-activation-surround":432},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":36,"body":138,"description":425,"extension":426,"links":427,"meta":428,"navigation":429,"path":37,"seo":430,"stem":38,"__hash__":431},"docs\u002F2.install\u002F2.activation.md",{"type":139,"value":140,"toc":417},"minimark",[141,145,149,154,162,165,276,286,290,297,304,310,314,317,337,356,362,366,373,376,380,387,398,402,413],[142,143,36],"h1",{"id":144},"activation",[146,147,148],"p",{},"Activation is the one thing your install cannot derive for itself. A deployment has to prove to the Hub that it is the deployment you said it was, and the Hub has to hand back a license that only this cluster can use. The activation code is what connects the two.",[150,151,153],"h2",{"id":152},"getting-a-code","Getting a code",[146,155,156,157,161],{},"You mint the code from the Hub console, against the deployment record for this install. The console calls the admin-gated ",[158,159,160],"code",{},"POST \u002Fv1\u002Fdeployments\u002F{id}\u002Factivation-code",", so only someone who can already sign in as an operator can issue one.",[146,163,164],{},"An MVNO enrolling under an MVNE rather than under the public Hub mints its code from that MVNE's console instead, and passes the parent's URL alongside it:",[166,167,172],"pre",{"className":168,"code":169,"language":170,"meta":171,"style":171},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","helm install my-mvno oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform --version \u003Cchart-version> \\\n  --namespace my-mvno --create-namespace \\\n  --set platform.kind=mvno \\\n  --set platform.host=esim.acme.com \\\n  --set activation.code=\u003Ccode-from-the-mvne-console> \\\n  --set activation.parentUrl=https:\u002F\u002Fmvne.themvne.com\n","bash","",[158,173,174,213,226,237,247,268],{"__ignoreMap":171},[175,176,179,183,187,190,193,196,200,203,207,210],"span",{"class":177,"line":178},"line",1,[175,180,182],{"class":181},"sBMFI","helm",[175,184,186],{"class":185},"sfazB"," install",[175,188,189],{"class":185}," my-mvno",[175,191,192],{"class":185}," oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform",[175,194,195],{"class":185}," --version",[175,197,199],{"class":198},"sMK4o"," \u003C",[175,201,202],{"class":185},"chart-versio",[175,204,206],{"class":205},"sTEyZ","n",[175,208,209],{"class":198},">",[175,211,212],{"class":205}," \\\n",[175,214,216,219,221,224],{"class":177,"line":215},2,[175,217,218],{"class":185},"  --namespace",[175,220,189],{"class":185},[175,222,223],{"class":185}," --create-namespace",[175,225,212],{"class":205},[175,227,229,232,235],{"class":177,"line":228},3,[175,230,231],{"class":185},"  --set",[175,233,234],{"class":185}," platform.kind=mvno",[175,236,212],{"class":205},[175,238,240,242,245],{"class":177,"line":239},4,[175,241,231],{"class":185},[175,243,244],{"class":185}," platform.host=esim.acme.com",[175,246,212],{"class":205},[175,248,250,252,255,258,261,264,266],{"class":177,"line":249},5,[175,251,231],{"class":185},[175,253,254],{"class":185}," activation.code=",[175,256,257],{"class":198},"\u003C",[175,259,260],{"class":185},"code-from-the-mvne-consol",[175,262,263],{"class":205},"e",[175,265,209],{"class":198},[175,267,212],{"class":205},[175,269,271,273],{"class":177,"line":270},6,[175,272,231],{"class":185},[175,274,275],{"class":185}," activation.parentUrl=https:\u002F\u002Fmvne.themvne.com\n",[146,277,278,281,282,285],{},[158,279,280],{},"activation.parentUrl"," defaults to ",[158,283,284],{},"https:\u002F\u002Fhub.solvegio.com",". It is the URL the agent enrolls against, and the URL your platform pins as its parent for everything afterwards.",[150,287,289],{"id":288},"what-the-code-actually-is","What the code actually is",[146,291,292,293,296],{},"What the console gives you is one string with two parts joined by a dot: the code itself, and a fingerprint of the parent's signing key. Paste the whole thing into ",[158,294,295],{},"activation.code"," exactly as the console printed it. Do not split it, and do not trim anything after the last dot.",[146,298,299,300,303],{},"The fingerprint half is a trust anchor. Before the agent sends the code anywhere, it fetches the parent's public keys from ",[158,301,302],{},"\u003Cactivation.parentUrl>\u002F.well-known\u002Fjwks.json"," and checks that the fingerprint in your code matches a key that is really published there. If nothing matches, the agent refuses to enroll rather than trusting whatever answered. That check is why the code is worth pasting carefully: it is what stops a deployment from enrolling against something that merely looks like the Hub.",[146,305,306,309],{},[158,307,308],{},"activation.allowUnpinned"," exists for local smoke runs and nothing else. Released builds refuse an unpinned enrollment whatever that value says.",[150,311,313],{"id":312},"what-happens-when-the-agent-redeems-it","What happens when the agent redeems it",[146,315,316],{},"The order here is the point.",[146,318,319,320,324,325,332,333,336],{},"The license agent generates an Ed25519 signing key ",[321,322,323],"strong",{},"first",", inside your cluster, before it has spoken to anyone. It keeps the private half in your platform Secret, in your namespace. It then signs a proof of possession over the activation request itself (DPoP, ",[326,327,331],"a",{"href":328,"rel":329},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9449",[330],"nofollow","RFC 9449",") and posts the code, its public key, and that proof to ",[158,334,335],{},"POST \u002Fv1\u002Fdeployments\u002Factivate",".",[146,338,339,340,343,344,349,350,355],{},"The Hub verifies the proof before it touches the code. Only once it is satisfied that the caller really holds the private key does it redeem the code, and the license it mints back is bound to the fingerprint of that public key through a ",[158,341,342],{},"cnf"," claim (",[326,345,348],{"href":346,"rel":347},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7800",[330],"RFC 7800",", thumbprint per ",[326,351,354],{"href":352,"rel":353},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7638",[330],"RFC 7638","). A license lifted out of your Secret is worth nothing to anyone who cannot also sign with the key it names.",[146,357,358,359,361],{},"The private key never leaves the cluster. The Hub only ever sees the public half. ",[326,360,78],{"href":79}," goes through what that does and does not protect you from.",[150,363,365],{"id":364},"single-use-and-short-lived","Single use, and short lived",[146,367,368,369,372],{},"A code redeems once and expires quickly: the default TTL is 15 minutes. Mint it when you are about to run ",[158,370,371],{},"helm install",", not the day before. An expired code is not a problem, it is just a code you mint again.",[146,374,375],{},"A failed attempt does not burn the code. The Hub verifies the proof of possession before it marks the code consumed, so a bad proof, a network drop, or an agent that crashed halfway through leaves the code exactly as it was: still pending, still redeemable. The agent will keep retrying on its own, and a retry from the same deployment with the same key is treated as the same activation rather than a second one.",[150,377,379],{"id":378},"leave-the-code-in-your-values","Leave the code in your values",[146,381,382,383,386],{},"Once the code is consumed, the value is harmless where it is. Running ",[158,384,385],{},"helm upgrade"," again with the same code does nothing at all: the agent tracks the codes it has already used and no-ops on one it has seen.",[146,388,389,390,392,393,395,396,336],{},"Keep it there anyway. Recovering a revoked deployment is a fresh code and a ",[158,391,385],{},", and that path reads ",[158,394,295],{}," from the same place. See ",[326,397,86],{"href":87},[150,399,401],{"id":400},"when-it-does-not-work","When it does not work",[146,403,404,405,407,408,410,411,336],{},"The agent logs every attempt. Start with its logs, which ",[326,406,44],{"href":45}," shows you how to read, and then ",[326,409,120],{"href":121}," for the specific errors. The wider picture, including what happens to the license after activation, is in ",[326,412,74],{"href":75},[414,415,416],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":171,"searchDepth":178,"depth":215,"links":418},[419,420,421,422,423,424],{"id":152,"depth":215,"text":153},{"id":288,"depth":215,"text":289},{"id":312,"depth":215,"text":313},{"id":364,"depth":215,"text":365},{"id":378,"depth":215,"text":379},{"id":400,"depth":215,"text":401},"Where the activation code comes from and what the license agent does with it.","md",null,{},true,{"title":36,"description":425},"3yRCgn2tdKKIdm5MzxD5UqwbTxvj_3n7wP9fr87az4Q",[433,435],{"title":32,"path":33,"stem":34,"description":434,"children":-1},"Install a self-hosted MVNE or MVNO from the published OCI chart with two values.",{"title":40,"path":41,"stem":42,"description":436,"children":-1},"Point a hostname at the ingress and let cert-manager issue the certificate.",1783967741116]